Analysis
-
max time kernel
155s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 01:43
Static task
static1
Behavioral task
behavioral1
Sample
2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe
-
Size
219KB
-
MD5
4b2896df59ebafd1a0c779c126eb1440
-
SHA1
ace957fd3c43b874b2d0b4185dbd3767b9de1914
-
SHA256
2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac
-
SHA512
72b76d92795c0e7001d0ad18c7dc145f4e57b3911ee6978ba56c02d9fae8b99d0e2e2aa330202d70e8c82dfdb55c88dd2d85123323121e4ea1a0d2f483e50f76
-
SSDEEP
6144:YJzzp7LC8It3bIbjDAOXX+suMBvcNMyLcj:sXIt3EbZX+smNvcj
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bsserver25 nov.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bsserver25 nov.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bsserver25 nov.exe" 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BCEB68D-10AF-6A4B-C47A-A2AECFFFDDAD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\bsserver25 nov.exe" 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0BCEB68D-10AF-6A4B-C47A-A2AECFFFDDAD} 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0BCEB68D-10AF-6A4B-C47A-A2AECFFFDDAD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\bsserver25 nov.exe" 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BCEB68D-10AF-6A4B-C47A-A2AECFFFDDAD} 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe -
resource yara_rule behavioral2/memory/5064-135-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/5064-137-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/5064-138-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/5064-142-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/5064-151-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bsserver25 nov.exe" 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\bsserver25 nov.exe" 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5024 set thread context of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1456 reg.exe 3964 reg.exe 636 reg.exe 1548 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeCreateTokenPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeAssignPrimaryTokenPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeLockMemoryPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeIncreaseQuotaPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeMachineAccountPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeTcbPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeSecurityPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeTakeOwnershipPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeLoadDriverPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeSystemProfilePrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeSystemtimePrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeProfSingleProcessPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeIncBasePriorityPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeCreatePagefilePrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeCreatePermanentPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeBackupPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeRestorePrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeShutdownPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeDebugPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeAuditPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeSystemEnvironmentPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeChangeNotifyPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeRemoteShutdownPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeUndockPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeSyncAgentPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeEnableDelegationPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeManageVolumePrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeImpersonatePrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeCreateGlobalPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: 31 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: 32 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: 33 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: 34 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: 35 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe Token: SeDebugPrivilege 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5024 wrote to memory of 5064 5024 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 82 PID 5064 wrote to memory of 2824 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 83 PID 5064 wrote to memory of 2824 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 83 PID 5064 wrote to memory of 2824 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 83 PID 5064 wrote to memory of 2328 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 84 PID 5064 wrote to memory of 2328 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 84 PID 5064 wrote to memory of 2328 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 84 PID 5064 wrote to memory of 4836 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 85 PID 5064 wrote to memory of 4836 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 85 PID 5064 wrote to memory of 4836 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 85 PID 5064 wrote to memory of 4764 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 86 PID 5064 wrote to memory of 4764 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 86 PID 5064 wrote to memory of 4764 5064 2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe 86 PID 2328 wrote to memory of 1548 2328 cmd.exe 91 PID 2328 wrote to memory of 1548 2328 cmd.exe 91 PID 2328 wrote to memory of 1548 2328 cmd.exe 91 PID 2824 wrote to memory of 3964 2824 cmd.exe 93 PID 2824 wrote to memory of 3964 2824 cmd.exe 93 PID 2824 wrote to memory of 3964 2824 cmd.exe 93 PID 4836 wrote to memory of 1456 4836 cmd.exe 92 PID 4836 wrote to memory of 1456 4836 cmd.exe 92 PID 4836 wrote to memory of 1456 4836 cmd.exe 92 PID 4764 wrote to memory of 636 4764 cmd.exe 94 PID 4764 wrote to memory of 636 4764 cmd.exe 94 PID 4764 wrote to memory of 636 4764 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe"C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exeC:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:3964
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2427fd62a4257fe61bf3006863f8c93571642b1a5648175a238a26ca0a4435ac.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1456
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bsserver25 nov.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bsserver25 nov.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bsserver25 nov.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bsserver25 nov.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:636
-
-
-